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A METHOD FOR ASSIGNING A REMOTE CONTROL OPERATION TO A 

BASE STATION 

RECEIVED 

Background Information APR 2 4 2003 

Technology Center 2600 
The invention relates to a method in accordance with the 
species of the main claim, as described in the German Patent 
5 Application AZ : 196 45 769.6. In accordance therewith, the 
assignment of a remote control operation to a base station 
arranged in a motor vehicle takes place by the base station 
transmitting a search signal, in response to which the remote 
control operations located in the transmission range of the 

10 search signal respond by transmitting back a contact signal at 
time points characteristic for the remote control operations. 
By evaluating the entry time points of the contact signal 
return transmissions, the base station detects the available 
remote control operations. It selects one of them and carries 

15 out with it a "challenge response" verification. Because an 
unequivocal remote control recognition is possible through 
exchanging only one signal, and the signal can be designed in 
a simple manner because it is not security-relevant, the 
entire detection [recognition] process proceeds very rapidly. 

20 Therefore, for the speed of assignment, it is above all the 
subsequent challenge-response verification that is 
determinative. The verification is based on carrying out 
security-relevant arithmetic operations, which are extensive 
and, accordingly, require time. To rapidly calculate the 

25 challenge or response signal, user- specif ic , integrated 

circuits (ASIC) specially developed for this purpose are used, 
which carry out the challenge or response calculation in less 
than three milliseconds. Thus the triggering of the assignment 
test [verification] can take place as a result of actuating 

3 0 the door handle of a motor vehicle, so that the door can only 
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be opened if the remote control operation has been verified as 
belonging to the motor vehicle. The user does not notice the 
assignment process. The above-mentioned ASICs perform their 
function well, but they are comparatively expensive to 
5 manufacture . 

It is the objective of the invention to indicate a method for 
assigning a remote control operation to a base station, the 
method permitting a rapid execution of an assignment test, in 
10 particular a rapid execution of a verification communication. 

The objective is achieved through a method having the features 
of the main claim. The method according to the invention can 
be easily realized as a program in the microprocessor that is 
15 present in any case in the base station and in the remote 
control operation, making the availability of an ASIC 
superfluous. In this context, the method assures the same 
security [reliability] as when an ASIC is used. 

Advantageously, an increase in security can be realized due to 
20 the fact that the speed of the challenge-response calculation 
can be controlled in a deliberate manner if the challenge- 
response dialog is carried out multiple times one immediately 
after the other. 

25 One exemplary embodiment of the invention is discussed in 
greater detail below with reference to the drawing. 

Drawing 

30 Figure 1 depicts a block diagram of an access device, and 
Figure 2 depicts a flowchart to make clear its operation. 
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Description 

Figure 1 depicts a base station 10, which can be a part of an 
apparatus or object, or which is permanently assigned to one 
5 such. For example, the base station can be a part of the 

access control device of a building or of a motor vehicle. A 
further component of the access device depicted in Figure 1 is 
an operating device [control mechanism] 2 0 designated 
hereinafter as remote control operation, which is assigned to 

10 the base station functionally via a contactless signal 
transmission link 30. The remote control operation, in 
particular, can be a transponder. Via undepicted operative 
connections, base station 10 acts upon the technical device, 
to which or to a part of which, it is assigned. When used in a 

15 motor vehicle, it controls, for example, access to the vehicle 
or to its ignition. 

A component of base station 10 is a microprocessor 13, which 
controls [monitors] the operation of base station 10, for this 

20 purpose, in particular, prompting the transmission of signals 
and evaluating incoming signals. Connected to the 
microprocessor is a transmitting/receiving device 11 for 
transmitting or receiving signals that are transmitted, 
without contact, via signal transmission link 30. Furthermore, 

25 microprocessor 13 has assigned to it a memory 14. In it is 
found assignment information, on the basis of which base 
station 10 recognizes assigned remote control operations 20. 
The assignment information is: a serial number 15, a 
manufacturer code 17, an encryption^ keycode 31, a directory 16 



^ Translator s note ; The German word rendered here and elsewhere as 
encryption is kryptisch, which may mean either encryption (i.e., 
capable of being encrypted) or encrypted. 

3 
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having information on remote control operations 2 0 assigned to 
base station 10, and a random number 18. Serial number 15 is 
characteristic for base stations 10 and remote control 
operations 20 that are assigned to each other. It is 
5 determined by the manufacturer of the technical device to 
which base station 10 and remote control operations 20 are 
assigned. For use in motor vehicles, the determination can be 
made by the vehicle manufacturer. Manufacturer code 17 
unambiguously designates the corresponding apparatus, i.e., 

10 base station 10. It is issued by the manufacturer of the base 
station and is unchangeable. Directory 16 contains for every 
assigned remote control operation 20 a data record 16a, 16b, 
16c, each of which contains group number 2 5 of a remote 
control operation 20, its manufacturer code 27, a random 

15 number, as well as a setpoint response. Group numbers 25, in 
this context, distinguish the remote control operations that 
have the same serial numbers and that are assigned to a base 
station 10, and manufacturer code 27, specific in each case, 
in connection with encryption keycode 31 and random number 18, 

20 which is generated by microprocessor 13, functions to produce 
the setpoint response. Encryption keycode 31 is also 
advantageously determined by the manufacturer of the 
corresponding technical device, such as a motor vehicle 
manufacturer. In each case, an entire data record 16a, 16b, 

25 16c makes possible the verification of a corresponding remote 
control operation 20. 

The remote control operation has at its disposal a 
transmitting/receiving device 21 corresponding to base- 
30 station-side transmitting/receiving device 11, for receiving 
signals transmitted by base station 10 or for transmitting 
signals to base station 10. By analogy to the base station, a 

4 
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microprocessor 23 is connected downstream of 
transmitting/receiving device 21, the microprocessor 
controlling the operation of remote control operation 20, 
especially undertaking the evaluation of the signals coming in 
5 via transmitting/receiving device 22, [but also] initiating 
subsequent measures as a function of the results, and 
monitoring the generation of output signals. Microprocessor 23 
has assigned to it a memory unit 24, wherein assignment 
information is stored for assigning remote control operation 

10 20 to a base station 10. Stored for this purpose -- by analogy 
to base station 10 -- are a serial number 15, a group number 
25, a manufacturer code 27, as well as an encryption keycode 
31. The significance of the memory contents corresponds 
specifically to the significance of the similar memory 

15 contents in memory 14 of base station 10. The manufacturer 

code is issued by the manufacturer of remote control operation 
2 0 and designates the latter unambiguously. Serial number 15 
is a code that is characteristic for the entire device 
composed of base station 10 and corresponding remote control 

20 operations 20 and is identical to the serial number contained 
in memory 14 of base station 10. Group number 25 distinguishes 
remote control operations from each other having same serial 
number 15. The group number is determined by the user in 
response to the use of the entire device. Encryption keycode 

25 31 is determined by the manufacturer of the technical device 
corresponding to base station 10, and it is identical to the 
one present in the base station. In connection with 
manufacturer code 27 and the challenge signal supplied by base 
station 10 via signal transmission link 30, the encryption 

30 keycode functions to verify the matching to a base station 10. 

Between base station 10 and remote control operations 20, 

5 
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there exists a signal transmission link for transmitting 
contactless transmissible signals between remot e- control - 
operation-side transmitting/receiving device 21 and base- 
station-side transmitting/receiving device 11. The signals 
5 emitted by base-station- side transmitting/receiving device 11, 
in this context, reach all remote control operations 20 
located within their transmission range. As signals, it is 
expedient to use infrared or high frequency signals. 

10 One base station 10 can have assigned to it a plurality of 

remote control operations 20. All remote control operations 20 
and base station 10 have available to them in their memories 
14, 24 an identical serial number 15 and, in the verification, 
make use of an encryption keycode 31. Individual remote 

15 control operations 20 are distinguished by their group numbers 
25 and their manufacturer code 27. 

On the basis of Figure 2, the operation of the device depicted 
in Figure 1 is explained. In this context, a letter B or F is 
20 placed in front of each sequence step, indicating whether the 
corresponding sequence step takes place in base station 10: B 
or in a remote control operation 20: F. 

The assignment process is triggered by the actuation of an 
25 undepicted mechanical, electrical, or electro-optical 

triggering mechanism by a user, step 100. When used in a motor 
vehicle, the triggering mechanism can, specifically, entail 
the actuating of the door handle. 

30 On the basis of a signal emitted in response to triggering, 
microprocessor 13 of base station 10 first sets an internal 
counter A at value 0, step 102. Then the microprocessor from a 

6 
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memory 14 loads random number 18, which then constitutes, for 
all remote control operations 20 assigned to base station 10, 
the activation signal, hereinafter termed the "challenge" 
signal, and expected response signals 16a, 16b, 16c, 
5 hereinafter termed "setpoint response," step 104. Thereafter, 
the microprocessor raises counter A by 1, step 106. 
Subsequently, microprocessor 13 initiates the transmission of 
a search signal by transmitting/receiving device 11, step 108. 
The search signal, in addition to start- and synchronization 

10 information, contains, in particular, serial number 15 stored 
in memory 14. The search signal, advantageously, is 
unencrypted and is received by all remote control operations 
2 0 located within the transmission range of signal 
transmission link 30 through their transmitting/receiving 

15 devices 21. 

Their microprocessors 23, upon receiving a search signal, test 
whether serial number 15 transmitted along with the search 
signal agrees with the serial number functioning as reference 

20 signal and stored in memory 24 of remote control operation 20. 

In the case of non- agreement , remote control operation 20 does 
not participate further in the matching test. In the event of 
agreement between the signals compared with each other, 
microprocessor 23 brings about a response in the form of a 

25 contact signal, step 112. Functioning as contact signal is a 
short, simply constructed signal, for example group number 25 
of respective remote control operation 2 0 in bit -coded form. 
It is advantageous if the contact signal, like the search 
signal, is unencrypted. The transmission of the contact signal 

30 is effected by microprocessor 24 after the expiration of a 
time interval from the reception of the search signal, the 
time interval being determined by group number 2 5 and being 

7 
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characteristic for remote control operation 20. The 
transmission then takes place in a time window having 
predetermined length. The transmission is dimensioned such 
that a reliable assignment of the contact signal to the time 
5 window is possible both for remote control operation 20 as 
well as for base station 10. 

By checking the time windows in which the contact signals have 
been received, microprocessor 13 of base station 10 then 

10 establishes which remote control operations 20 having which 
group numbers are present, step 114. If no remote control 
operation 2 0 is detected as being present, microprocessor 13 
checks the value of counter A, step 116. If it is smaller than 
a predetermined reference value, for example 5, the 

15 microprocessor immediately once again causes the transmission 
of a search signal and repeats the process from step 106 in 
sequence. If the reference value is exceeded, microprocessor 
13 interrupts the matching test, step 117. If the check test 
in step 114 yielded the result that at least one remote 

2 0 control operation 2 0 is present, microprocessor 13, from among 

present remote control operations 20, selects one, using which 
it subsequently carries out a matching test, step 118. After 
selecting a remote control operation, it sets a second 
internal counter B up one level, step 120. Thereafter, 
25 microprocessor 13 causes the transmission of a subsequent 

challenge signal via transmitting/receiving device 11. Random 
number 18, stored in memory 14, functions as the challenge 
signal . 

3 0 Selected remote control operation 20, through its 

transmitting/receiving device 21, receives the challenge 
signal and from it, in connection with manufacturer code 2 7 

8 
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and encryption keycode 31, formulates a "response" signal, 
which the remote control operation returns to base station 10 
as the responding signal, step 124. 

5 Microprocessor 13 of base station 10 compares for content the 
response signal sent back by remote control operation 2 0 with 
setpoint response signals 16a, 16b, 16c, previously loaded in 
step 104, of selected remote control operation 20, step 126. 
If the setpoint response signal and the response signal agree, 

10 microprocessor 13 sets internal counter B back to value 0, 

step 132, and it causes the transmission of a release signal, 
which, for example, makes possible the access to a motor 
vehicle and/or its operation, step 134. Subsequently, 
microprocessor 13 determines a random number 18 and, for every 

15 group number 25 entered in directory 16, establishes a new 

setpoint response signal, step 136. Using random number 18 and 
the newly formed setpoint response signals, the microprocessor 
then once again occupies memory locations 16a, 16b, 16c, and 
18. The new memory contents function as the basis for the 

2 0 assignment test in connection with the next renewed triggering 

process. In rewriting memory contents 16 and 18, the matching 
test process is terminated, step 138. 

If the check test in step 126 yields the result that the 
25 response signal sent back from remote control operation 2 0 
does not agree with setpoint response signal 16a, 16b, 16c, 
loaded from the processor, microprocessor 13 sets internal 
counter B higher by one level, step 128. It then checks as to 
whether the contents of counter B exceed a prescribed limit 

3 0 value, for example, the value 3, step 13 0. If that is the 

case, microprocessor 13, in accordance with step 136, 
establishes a new random number 18 and new setpoint response 

9 
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signals 16a, 16b, 16c, using which it overwrites the 
corresponding memory contents in memory 14 . Then it terminates 
the assignment test process, step 13 8. 

5 If the check test in step 130 yields the result that the limit 
value assigned to counter B has not yet been exceeded, 
microprocessor 13 also carries out a redetermination of random 
number 18 and of setpoint response signals 16a, 16b, 16c, in 
accordance with step 136. Subsequently, however, it continues 
10 in the repetition of step 104 and immediately reloads the 

redefined memory contents 18 and 16a, 16b, 16c, to carry out 
subsequent step 106. 

Provision can be made to carry out the determination of a new 
random number and a new setpoint response signal in accordance 
with step 136 in a controlled and deliberate manner. Since the 
redetermination takes place only in response to an authorized 
use in connection with the confirmation of matching and of the 
transmission of a release signal, a deliberate execution of 
step 136 does not have an impact for the authorized user. On 
the contrary, it is made more difficult for an unauthorized 
user to simulate a matching of a remote control operation to a 
base station, even if it should be possible to cause the base 
station to transmit the challenge signal to the remote control 
operation by simulating a contact signal. Through a controlled 
lengthening of the time for carrying out step 136, it is also 
made more difficult to discover a correct response signal 
through a permutative repetition of possible response signals. 

30 
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What Is Claimed Is: 



1. A method for assigning a remote control operation to a base 
station, the base station (10) transmitting (108) a search 
signal, the remote control operation (20) returning (112) a 
contact signal in response to agreement of the search signal 
with a stored reference signal, and base station (10) 
subsequently transmitting (122) an activation signal, that can 
be changed in response to each assignment, for verifying the 
matching to the remote control operation, 

wherein the changeable activation signal is determined already 
before the search signal is transmitted from the base station 
(136) and is only recalled for the assignment (104) . 

2. The method as recited in Claim 1, 

wherein, already before the search signal is transmitted by 
the base station (10) , the response signal is also determined 
(13 6) , using which the corresponding remote control operation 
(20) is to respond after receiving the changeable activation 
signal . 

3. The method as recited in Claim 1, 

wherein the determination of the changeable activation signal 
takes place, in each case, after the conclusion of a 
successful assignment (126, 134) of a remote control operation 
(20) to a base station (10) . 

4. The method as recited in Claim 1, 

wherein a new, changeable activation signal is determined 
(136) if a response signal sent back by a remote control 
operation (20) in response to an activation signal does not 
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agree with the predetermined setpoint response signal in the 
base station (10) . 

5. The method as recited in Claim 1, 

wherein the search signal is transmitted multiple times, one 
immediately after the other, if no contact signal is received 
in response to the preceding search signal. 

6. The method as recited in Claim 4, 

wherein the execution time in the redetermination of the 
changeable activation signal is lengthened in comparison to 
the shortest possible one. 

7. A base station for carrying out the method as recited in 
Claim 1, 

characterized by 

- a transmitting/receiving device (11) , which is designed for 
transmitting search and activation signals as well as for 
receiving contact and response signals from remote control 
operations (20) , 

- a means (13) for causing/evaluating the signals to be 
transmitted/which were received by the transmitting/ receiving 
device (11) , 

- as well as a non-volatile memory unit (14) for storing fixed 
and changeable assignment information (15, 17, 31, 16, 18), 
which assigns at least one remote control operation (20) to 
the base station (10) and makes possible the test for 
matching . 

8. The base station as recited in Claim 7, 

wherein the non-volatile memory unit (14) is executed as a 
memory medium that can be programmed exactly once. 

12 
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9. A remote control operation for carrying out the method as 
recited in Claim 1, 
characterized by 

- a transmitting/receiving device (21) , which is designed to 
receive search and activation signals, as well as to transmit 
contact and response signals, 

- means (23) for evaluating/causing signals to be received/to 
be transmitted, 

- and a non-volatile memory unit (24) for storing assignment 
information (15, 25, 27, 31) , which assigns the remote control 
operation (20) to a base station (10) . 
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Abstract 

A method is proposed for assigning a remote control operation 
to a base station. In this context, the base station (10) 
transmits a search signal (108) , in response to which the 
remote control operation (20) returns (112) a contact signal 
if the search signal agrees with a stored reference signal. 
After the reception of the contact signal, the base station 
(10) transmits (122) an activation signal, that can be changed 
in response to each assignment, for verifying the matching to 
the remote control operation (20) . In this context, the 
changeable activation signal is determined (13 6) already 
before the search signal is transmitted from the base station 
and is only recalled for the assignment (104) . 
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Reference Key for Drawing 

Figure 1 

5 15 serial number 
16 directory 

16 group number manufacturer code S-A 
16 group number manufacturer code S-A 

16 group number manufacturer code S-A 
10 18 random number 

17 manufacturer code 
31 encryption keycode 

13 microprocessor 
15 11 transmitting/receiving 

21 transmitting/ receiving 
23 microprocessor 

20 15 serial number 
2 5 group number 
2 7 manufacturer code 
31 encryption keycode 
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100 triggering 
102 B counter A: = 0 
3 0 104 B loading activation signal + setpoint response 

136 B determination of activation signal + setpoint response 
106 B counter A + 1 
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